CVE-2026-109430

Executive Summary

CVE-2026-109430 is an unauthenticated XML External Entity (XXE) injection vulnerability in Ellucian WebAdvisor 3.2, triggered by crafted XML POST requests sent to the /WebAdvisor/WebAdvisor endpoint. Because the application does not disable external entity or DTD resolution, a remote unauthenticated attacker can coerce the server into making SSRF requests, disclose NTLMv2 hashes via attacker-controlled SMB shares, and exfiltrate arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor reached end-of-support in June 2022, so no vendor patch is expected; affected institutions are exposed unless they migrate to Colleague Self-Service or apply compensating controls.

Technical Analysis

The vulnerability is an instance of CWE-611 (Improper Restriction of XML External Entity Reference) affecting Ellucian WebAdvisor version 3.2. WebAdvisor is a web-based self-service portal historically deployed alongside Ellucian Colleague at higher-education institutions and typically hosted on Windows/IIS infrastructure in on-premises environments.

The flaw resides in how the application processes XML input received at the /WebAdvisor/WebAdvisor endpoint. When an XML parser is configured with external entity and DTD resolution enabled (the default in many legacy .NET and Java XML parsing configurations), a document's DOCTYPE declaration can define external entities whose system identifiers point to resources the parser will dereference on the server's behalf. CVE-2026-109430 arises precisely because the affected endpoint does not disable external entity and DTD resolution prior to parsing attacker-supplied XML POST bodies.

This configuration error yields three distinct exploitation primitives, all of which flow from the same root cause:

1. Server-Side Request Forgery (SSRF): The parser dereferences attacker-specified URIs, causing the WebAdvisor server to issue HTTP(S) or other protocol requests to internal or external destinations reachable from the server's network position.
2. Out-of-band NTLMv2 hash disclosure: By pointing an external entity at a UNC path on an attacker-controlled SMB server, the Windows host initiates an outbound SMB authentication attempt. The resulting NTLMv2 challenge/response (including the NetNTLMv2 hash material) is captured by the attacker. These hashes are typically relayed or cracked offline; NTLMv2 responses can be relayed under favorable conditions (e.g., SMB signing not required).
3. Arbitrary file read: The parser can resolve entities to local file URIs, and the resulting content is returned to the attacker through an out-of-band error-based channel — meaning data is leaked via application error messages or observable response behavior rather than a direct, clean echo of file contents.

No public proof-of-concept, exploit code, or Nuclei template was available at the time of this assessment. The attack chain described below is therefore inferred from the XXE vulnerability class and the mechanisms explicitly enumerated in the NVD description. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the vulnerability is network-exploitable, low-complexity, requires no privileges or user interaction, does not cross a security scope boundary, and results in high confidentiality impact only — no integrity or availability impact is described.

Exploitation Scenarios

The following attack chain follows the mechanics stated in the NVD description. No specific function names, parameters, or file paths beyond the /WebAdvisor/WebAdvisor endpoint are asserted, because the available intelligence does not provide them.

1) Reconnaissance and target identification. An attacker identifies internet-facing (or reachable internal) Ellucian WebAdvisor 3.2 deployments. WebAdvisor portals are discoverable via search engines and Shodan using content/title matches on "WebAdvisor." The attacker confirms the /WebAdvisor/WebAdvisor endpoint is reachable and that it accepts XML request bodies.

2) Triggering the flaw class. The attacker sends an XML POST request to /WebAdvisor/WebAdvisor containing a DOCTYPE declaration that defines one or more external entities. Because the server parses this input without disabling external entity or DTD resolution, the parser attempts to resolve those entity references. Triggering requires no authentication and no user interaction.

3) Payload and execution at the vulnerability-class level. Three payload categories are relevant, each keyed to the same parser misconfiguration:

• SSRF: External entity system identifiers are set to URLs (HTTP/S or other schemes) targeting internal services. Successful exploitation forces the server to issue requests to those destinations, enabling internal network probing and access to otherwise unreachable services.
• NTLMv2 coercion: External entity system identifiers are set to UNC paths pointing at an attacker-controlled SMB share (e.g., a listener under the attacker's control). The Windows host initiates SMB authentication, and the attacker captures the NetNTLMv2 hash material. This enables offline password cracking and, where SMB signing is not enforced, NTLM relay.
• Arbitrary file read: External entity system identifiers reference local file URIs on the Windows host. File contents are exfiltrated out-of-band via error-based channels — the data surfaces through application errors or observable response differences rather than a direct inline echo.

4) Post-exploitation impact. The attacker gains: internal network reachability via SSRF; credential material (NTLMv2 hashes) usable for cracking or relay; and disclosure of files readable by the WebAdvisor service account on the Windows host — which may include configuration files, connection strings, and other sensitive material. These primitives can seed lateral movement and privilege escalation within the hosting environment.

Impact Assessment

CVE-2026-109430 rates CVSS v3.1 7.5 (High), with confidentiality as the sole impacted dimension (C:H) and no integrity or availability impact (I:N/A:N). The unauthenticated, low-complexity, no-interaction characteristics (PR:N, AC:L, UI:N, AV:N) make it trivially exploitable by any remote attacker with network access to the endpoint.

Affected systems are Ellucian WebAdvisor 3.2 deployments, predominantly Windows-hosted, on-premises web portals at colleges and universities. The blast radius includes the confidentiality of any file readable by the WebAdvisor service account and exposure of the server's network position to SSRF reconnaissance. Captured NTLMv2 hashes extend the blast radius beyond the immediate host: relay and cracking can pivot into adjacent Windows systems and Active Directory. Because WebAdvisor entered EOS in June 2022, the population of vulnerable, unmaintained instances is likely stable or growing as institutions defer migration.

Business impact for higher-education institutions includes potential disclosure of student, applicant, and financial-aid-related data reachable through the service account, exposure of internal authentication material, and compliance exposure under FERPA and institutional data-protection obligations. No exploitation in the wild, CISA KEV listing, or threat-actor campaign has been reported for this CVE.

Detection Guidance

Sigma Rule

title: XXE Exploitation Attempt Against Ellucian WebAdvisor
id: 8f3c1a26-7d4b-4e9a-9b2c-1a5f6d0e2c41
status: experimental
description: Detects XML POST requests to the WebAdvisor endpoint containing DOCTYPE or external entity declarations indicative of XXE (CVE-2026-109430).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109430
author: valtersit.com
date: 2025/01/01
logsource:
  category: webserver
  product: windows
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/WebAdvisor/WebAdvisor'
  selection_method:
    cs-method: 'POST'
  selection_xxe:
    - cs-uri-query|contains: 'DOCTYPE'
    - cs-uri-query|contains: 'SYSTEM'
    - cs-uri-query|contains: 'ENTITY'
    - cs-uri-query|contains: 'file://'
    - cs-uri-query|contains: '\\\\'
  condition: selection_endpoint and selection_method and selection_xxe
falsepositives:
  - Legitimate XML integrations that transmit DOCTYPE declarations
level: high

YARA Rule

rule CVE_2026_109430_XXE_WebAdvisor
{
    meta:
        description = "Detects XXE payloads targeting Ellucian WebAdvisor endpoint"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109430"
        author = "valtersit.com"
        date = "2025-01-01"
    strings:
        $ep   = "/WebAdvisor/WebAdvisor" ascii nocase
        $doctype = "<!DOCTYPE" ascii nocase
        $entity  = "<!ENTITY" ascii nocase
        $system  = "SYSTEM" ascii
        $file    = "file://" ascii nocase
        $unc     = "\\\\" ascii
    condition:
        uint16be(0) == 0x3C3F or $doctype
        and $entity
        and ( $system or $file or $unc )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109430 Ellucian WebAdvisor XXE Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/WebAdvisor/WebAdvisor"; http.request_body; content:"<!DOCTYPE"; nocase; http.request_body; content:"<!ENTITY"; nocase; http.request_body; pcre:"/(SYSTEM|file:\/\/|\\\\\\\\[^\\])/i"; classtype:web-application-attack; reference:cve,2026-109430; sid:2026109430; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      http.request.body.text contains "/WebAdvisor/WebAdvisor" and
      http.request.body.text contains "<!DOCTYPE" and
      http.request.body.text contains "<!ENTITY" ]
  [ network where network.protocol == "http" or network.protocol == "smb" ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=access_combined
  (cs_uri_stem="/WebAdvisor/WebAdvisor" OR uri_path="/WebAdvisor/WebAdvisor")
  method=POST
  (body="*<!DOCTYPE*" OR body="*<!ENTITY*" OR form_data="*SYSTEM*"
   OR form_data="*file://*" OR form_data="*\\\\*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips by host, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,xxe,webadvisor,">
  <rule id="100430" level="12">
    <if_sid>31100</if_sid>
    <id>^/WebAdvisor/WebAdvisor</id>
    <match>POST</match>
    <regex>DOCTYPE|ENTITY|SYSTEM|file://|\\\\</regex>
    <description>CVE-2026-109430: Possible XXE injection attempt against Ellucian WebAdvisor</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). WebAdvisor 3.2 is end-of-support as of June 2022; no vendor fix is expected, and no workaround is documented by the vendor.

1) Immediate mitigations (compensating controls):

• Disable external entity and DTD resolution in the XML parser handling the /WebAdvisor/WebAdvisor endpoint, if the deployment permits code/config modification. This is the root-cause fix for CWE-611 and blocks all three exploitation primitives.
• Where parser changes are not possible, deploy a WAF or reverse-proxy rule that rejects XML request bodies containing DOCTYPE/ENTITY declarations to the affected endpoint.
• Block outbound SMB (TCP 445/139) egress from the WebAdvisor server to untrusted networks to neutralize NTLMv2 coercion, and enforce SMB signing to prevent NTLM relay.
• Restrict outbound HTTP(S) egress from the WebAdvisor host to known-good destinations to blunt SSRF.
• Isolate the WebAdvisor server into a segmented network with least-privilege file-system access for the service account.

2) Patch / upgrade steps: No patch exists. The vendor-directed path is migration to Ellucian Colleague Self-Service. Institutions unable to migrate immediately should treat WebAdvisor 3.2 as permanently vulnerable and rely on the compensating controls above. Verify remediation with the detection rules in this report.

3) Long-term hardening: Eliminate deprecated EOS web components from the external attack surface; enforce secure XML parsing defaults (entities disabled, DTDs blocked) as a development standard; enforce SMB signing and disable NTLM where feasible; apply network egress allow-listing across all web tiers; and maintain an inventory of end-of-support software with defined decommission timelines.

References

• NVD — CVE-2026-109430: https://nvd.nist.gov/vuln/detail/CVE-2026-109430
• CWE-611 — Improper Restriction of XML External Entity Reference: https://cwe.mitre.org/data/definitions/611.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Ellucian WebAdvisor end-of-support notice (EOS June 2022) — Ellucian product lifecycle documentation
• OWASP — XML External Entity (XXE) Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

No public PoC, exploit-in-the-wild evidence, or threat-actor campaign is currently associated with CVE-2026-109430. CISA KEV listing: NO. EPSS: not yet scored by FIRST.org.